Protection of APIs exposed by mobile applications and their backend services. Includes authentication, authorization, traffic encryption, token management, input validation, rate limiting, and defense against specific attacks such as API abuse, credential stuffing, and man-in-the-middle on mobile channels.